Runbook: Firewall pravila

Kontrola pristupa za Data Gateway na mreznoj razini.

PowerShell (kao Admin):

# Ulazni: HTTPS dozvoliti
New-NetFirewallRule -DisplayName "Data Gateway HTTPS" `
    -Direction Inbound -Action Allow -Protocol TCP -LocalPort 443
 
# Ulazni: Samo od odredenih IP-ova
New-NetFirewallRule -DisplayName "Data Gateway HTTPS Restricted" `
    -Direction Inbound -Action Allow -Protocol TCP -LocalPort 443 `
    -RemoteAddress "10.0.0.0/8","192.168.0.0/16"
 
# Izlazni: SQL Server dozvoliti
New-NetFirewallRule -DisplayName "Data Gateway to SQL Server" `
    -Direction Outbound -Action Allow -Protocol TCP -RemotePort 1433
 
# Pravila ispisati
Get-NetFirewallRule -DisplayName "Data Gateway*" | Format-Table Name, Enabled, Direction, Action
 
# Pravilo ukloniti
Remove-NetFirewallRule -DisplayName "Data Gateway HTTPS"

# HTTPS port otvoriti
sudo firewall-cmd --permanent --add-port=443/tcp
 
# Samo iz odredene mreze
sudo firewall-cmd --permanent --add-rich-rule='
    rule family="ipv4"
    source address="10.0.0.0/8"
    port protocol="tcp" port="443"
    accept'
 
# Promjene primijeniti
sudo firewall-cmd --reload
 
# Pravila prikazati
sudo firewall-cmd --list-all
 
# Pravilo ukloniti
sudo firewall-cmd --permanent --remove-port=443/tcp
sudo firewall-cmd --reload

# HTTPS dozvoliti
sudo ufw allow 443/tcp
 
# Iz odredene mreze
sudo ufw allow from 10.0.0.0/8 to any port 443 proto tcp
 
# Status prikazati
sudo ufw status verbose
 
# Pravilo ukloniti
sudo ufw delete allow 443/tcp

# HTTPS dozvoliti
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
 
# Samo iz odredene mreze
sudo iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j DROP
 
# Pravila spremiti
sudo iptables-save > /etc/iptables/rules.v4
 
# Pravila prikazati
sudo iptables -L -n --line-numbers
 
# Pravilo ukloniti (po broju)
sudo iptables -D INPUT 3

# Security Group kreirati
aws ec2 create-security-group \
    --group-name gateway-sg \
    --description "Data Gateway Security Group" \
    --vpc-id vpc-12345678
 
# HTTPS od svuda
aws ec2 authorize-security-group-ingress \
    --group-id sg-12345678 \
    --protocol tcp \
    --port 443 \
    --cidr 0.0.0.0/0
 
# HTTPS samo iz VPN-a
aws ec2 authorize-security-group-ingress \
    --group-id sg-12345678 \
    --protocol tcp \
    --port 443 \
    --cidr 10.0.0.0/8

# NSG kreirati
az network nsg create \
    --resource-group rg-gateway \
    --name gateway-nsg
 
# HTTPS pravilo
az network nsg rule create \
    --resource-group rg-gateway \
    --nsg-name gateway-nsg \
    --name AllowHTTPS \
    --priority 100 \
    --direction Inbound \
    --access Allow \
    --protocol Tcp \
    --destination-port-ranges 443 \
    --source-address-prefixes '10.0.0.0/8'

Alternativa Firewallu: Filtriranje u aplikaciji.

appsettings.json:

{
  "Security": {
    "AllowedIPs": [
      "10.0.0.0/8",
      "192.168.0.0/16",
      "172.16.0.0/12"
    ]
  }
}

# Lokalno
curl https://localhost/health
 
# Iz dozvoljene mreze
curl https://gateway.example.com/health
 
# Izvana (treba biti blokirano)
curl --connect-timeout 5 https://gateway.example.com/health
# Ocekivanje: Connection refused ili Timeout

• TLS postavljanje - HTTPS aktivirati
• Kubernetes - NetworkPolicies
• Alerting - Monitoring konekcija

« <- Certifikat obnoviti | -> Operator pregled »

Wolfgang van der Stille @ EMSR DATA d.o.o. - Data Gateway Professional